Privacy Policy

    Last updated: 14 October 2026

    1. Who We Are

    Accounting Tutor AI ("we", "us", "our") operates the website accountingtutorai.com and the Accounting Tutor AI study platform (the "Service"). We are the data controllerresponsible for the personal data we collect about you when you use the Service. For any privacy question or request, contact us at support@accountingtutorai.org.

    2. Data We Collect

    2.1 Account details

    • Email address, name, and password (hashed) when you sign up directly;
    • Profile information (such as name and avatar) received from Google when you use Google Sign-In;
    • Subscription plan, trial status, and account preferences.

    2.2 Usage data

    • Pages and features accessed, chatbot questions asked, calculators run, MCQs attempted, and timestamps;
    • Approximate country location. When you sign in, we determine the country you are connecting from. Where our hosting provider supplies this directly, we use that; otherwise we send only your IP address to a third-party geolocation service (ipapi.co) to obtain a country. We store only the two-letter country code and country name against your account — we do not store your IP address. This is approximate and may be inaccurate, particularly if you use a VPN;
    • Browser type, device type, and operating system;
    • Diagnostic and error logs.

    2.3 Payment data

    • Subscription status, plan, currency, and billing history;
    • Full card numbers and bank details are handled directly by our payment processor (Stripe) and are never stored on our servers.

    2.4 Cookies and similar technologies

    We use cookies and local storage to keep you signed in, remember your preferences, and (with your consent) measure how the Service is used. See our Cookie Policy for the full list.

    3. How and Why We Use Your Data

    • To create and maintain your account and authenticate you;
    • To deliver the Service — including running the AI tutor, saving your chat history, journal entries, calculations, and MCQ progress;
    • To process payments, manage subscriptions, and prevent payment fraud;
    • To send essential service emails (account, billing, security, policy updates);
    • To improve, debug, and secure the Service;
    • To understand the geographic distribution of our users so we can prioritise content, regional pricing and support;
    • To produce aggregated, non-identifying analytics about how the Service is used;
    • To comply with legal obligations and enforce our Terms of Service.

    Professional use and client information. If you use the professional tools (the IFRS and interim disclosure checklists and the accounting memo generator), you may input business information relevant to a client or employer engagement. That information is processed only by the processors listed in Section 6 to deliver the Service to you, and — consistent with Section 6 — is not used to train AI models. As explained in our Terms of Service, you should avoid submitting identifying client details that are not necessary for the tool to work.

    4. Legal Bases for Processing (GDPR) and Accountability Under PIPEDA

    If you are in the UK, EU, or EEA, we rely on the following legal bases under the UK GDPR / EU GDPR. As an Ontario, Canada company, we also handle personal data in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), which requires consent, purpose limitation, and accountability for the personal data we collect — see Section 9.3 for your PIPEDA rights.

    • Contract — to provide the Service you have signed up for (account, AI tutor, subscription, history).
    • Legitimate interests — to secure the Service, prevent fraud and abuse, debug issues, and improve our product. We have assessed that these interests are not overridden by your rights.
    • Consent — for non-essential analytics cookies (gathered via the cookie banner) and any marketing communications. You can withdraw consent at any time.
    • Legal obligation — to keep accounting records, respond to lawful requests, and comply with tax laws.

    5. Cookies and Analytics

    Strictly necessary cookies (authentication, security, consent state) are always set because the Service cannot work without them. Analytics and performance cookies are only loaded after you accept them through the cookie banner. You can change or withdraw your choice at any time — see our Cookie Policy.

    6. Third-Party Processors and Sub-Processors

    We share personal data only with vetted service providers acting as processors on our behalf:

    • Supabase — authentication, database, and file storage hosting;
    • Stripe — payment processing, billing portal, and refunds;
    • Google (OAuth) — optional sign-in;
    • AI inference provider (Anthropic Claude API) — generates AI tutor responses from your questions; API data is not used by the provider to train AI models;
    • Email delivery provider — to send transactional and account emails;
    • Analytics provider — to measure aggregate usage (only after consent);
    • ipapi.co — IP-to-country lookup. Receives only your IP address; receives no name, email or other account data;
    • IFRS Foundation — licensor of the official accounting standards content used in the Service.

    An up-to-date list of sub-processors is available on request.

    7. Data Storage, Security and International Transfers

    Data is stored on cloud infrastructure operated by our hosting and processing providers, primarily in the EU and the United States. Where personal data is transferred outside your country, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent mechanisms. We apply industry-standard security measures including encryption in transit (TLS), encryption at rest, access controls, row level security, and regular backups. No system is 100% secure, but we work continuously to protect your data.

    8. Data Retention

    • Account data — kept while your account is active. If you delete your account, your profile and associated personal data are permanently removed from our active systems and cannot be undone;
    • Referral-code records — If your account was created using a referral code, we retain a one-way hashed form of your email address after deletion, solely to prevent repeat use of referral discounts. It is not used to identify or contact you;
    • Chat history, calculations, and journal entries — kept while your account is active so you can revisit them; deleted when you delete the items or your account;
    • Billing records — retained for up to 7 years to comply with tax and accounting laws;
    • Diagnostic logs — retained for up to 90 days;
    • Backups — purged on a rolling 30-day cycle.

    9. Your Rights

    Depending on where you live, you have the following rights in relation to your personal data. We will respond to verified requests within the time limits required by applicable law (typically 30 days under GDPR and 45 days under CCPA).

    9.1 Rights under GDPR (UK / EU / EEA)

    • Access — request a copy of the personal data we hold about you;
    • Rectification — ask us to correct inaccurate or incomplete data;
    • Erasure — ask us to delete your data ("right to be forgotten");
    • Portability — receive your data in a machine-readable format or have it sent to another controller;
    • Restriction — ask us to limit how we process your data;
    • Objection — object to processing based on legitimate interests or for direct marketing;
    • Withdraw consent — at any time, where we rely on consent;
    • Complain — to your local data protection authority (e.g. the UK ICO).

    9.2 Rights under CCPA / CPRA (California)

    • Right to know what personal information we collect, use, and disclose;
    • Right to delete personal information we have collected;
    • Right to correct inaccurate personal information;
    • Right to opt out of any "sale" or "sharing" of personal information — we do not sell or share personal information for cross-context behavioural advertising;
    • Right to non-discrimination for exercising your rights.

    9.3 Rights under PIPEDA (Canada)

    • Access — request access to the personal information we hold about you;
    • Correction — ask us to correct inaccurate or incomplete personal information;
    • Withdraw consent — withdraw your consent to our collection, use, or disclosure of your personal information, subject to legal or contractual restrictions;
    • Complain — file a complaint with the Office of the Privacy Commissioner of Canada (OPC) if you believe we have not complied with PIPEDA.

    9.4 How to exercise your rights

    Email support@accountingtutorai.org from the address associated with your account, or use our Contact page. We may ask for additional information to verify your identity before acting on a request.

    10. Children's Privacy

    The Service is not directed at children under 16 (or the higher local digital-consent age). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

    11. Changes to This Policy

    We may update this Privacy Policy from time to time. Material changes will be highlighted by an in-app notice or email. The "Last updated" date at the top of this page reflects the latest revision. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

    12. Contact Us

    For privacy questions, to exercise your rights, or to raise a complaint, email support@accountingtutorai.org or use our Contact page.